KR101399719B1 - Upgradable security module - Google Patents

Abstract

It is an object of the present invention to provide a security module capable of supporting different functionalities and physical configurations of the latest generation and previous generations while avoiding any new attack potential due to adaptability.

This object is achieved by a security module comprising a first communication means for a host device, a first storage means (MEM0) and a first decryption means (ENC0), comprising a status module (SM) and a second communication means (COM1) 2 means of physical activation or deactivation means (TSB), which activation or deactivation is accomplished by a security module managed by a status module (SM).

Security module, password, decryption, disk rambler, broadcast media

Description

Security module {UPGRADABLE SECURITY MODULE}

The present invention relates to the field of electronic security modules, and more particularly, to a security module for access control to broadcast events and other broadcast media.

Security operations are typically performed in a security module associated with a multimedia unit or decoder. Such a security module may be implemented in four different ways in particular. One type is a protected microprocessor card, a smart card, or more generally an electronic module (in the form of a key, a badge, etc.) in the form of ISO 7816. These modules are generally detachable and connectable to the decoder. Although forms with electronic contacts are the most commonly used form, connections that do not have contacts, such as, for example, the ISO 14443 type, are possible, or combinations thereof.

The second type of known security module is located in an integrated circuit package in such a way that it is generally fixed in the decoder case inseparably. Another form consists of a connector such as a SIM module connector or a circuit mounted on a fuse-base.

In a third form, the security module is integrated into an integrated circuit package having other functions, such as, for example, a decoder descrambling module or a decoder microprocessor.

In practice, the evolution of these security modules between the first module used in the decoder set and the module installed in the latest decoder is outstanding. For example, several generations of security modules may coexist within the same set of media distribution operators via satellite, cable, or the Internet.

If a security flaw is detected, the old module is replaced.

The differences between the module generations are often related to the services allowed for the relevant user equipment. If the module version does not have a "purse" function, it will not be possible to deduct from the credit and therefore it will be impossible to allow content consumption without a bidirectional exchange with the management center.

Thus, some generations of modules will provide a limited number of services.

This also limits your unit's ability to maintain compatibility with all modules of previous generations. The currently used process is that the user's unit identifies the security module. This identification can also be bi-directional, i.e. requiring the security module to know the same characteristics to the user's unit.

If the security module generation is changed, for example, the material may be changed by the availability of a new communication port. An example of such a security module is disclosed in U.S. Patent 6,779,734.

Thus, it is important that the security module is tailored to the user ' s unit and is capable of adjusting its functionality according to the communication means of the user ' s unit.

An unauthorized third party may attempt to access the high value service by making it look like the latest generation decoder, using the changed decoder. In this mode, the user will attempt to change the internal memory of the security module to favor himself. In addition, if there are advanced communication means such as USB 2.0, such a module allows these third parties to double their attacks by means of these high-speed communication means compared to other much slower means of communication (ISO 7816).

In the patent application EP 1 486 907, the security module is configurable according to the environment. Its purpose is to perform automatic configuration according to the signal received by the host device. Thus, if a malicious third party imitates a particular environment, the module will adapt to this environment even if it is not allowed.

It is an object of the present invention to provide a security module capable of supporting different functionalities and physical configurations of the latest generation and previous generations while avoiding any new attack potential due to this adaptability.

This object is achieved by a security module comprising a first communication means for a host device, a first storage means (MEM0) and a first decryption means (ENC0), comprising a status module (SM) and a second communication means (COM1) 2 means of electrical activation or deactivation means (TSB), said activation or deactivation means being controlled by a status module (SM), and means for receiving a protection message allowing the modification of said status module .

Thus, according to the state stored in the module state memory, the second communication means is not fully functional and can not be used by a third party for an unjust purpose. The electrical activation / deactivation of the communication means is controlled by elemental means such as a tri-state device or "High Voltage bidirectional MOSFET" depending on the result of the encryption operation.

This also applies to other parts of the security module, such as the memory zone. This memory may contain data, such as a key or serial number, which is completely inactive and inaccessible due to memory conditions. This memory state transmits a locking or unlocking element signal, so that even if the hack program operates in such a module, it can not access this memory. The same structure can be applied to other elements such as a decoding engine or an asymmetric decoding module.

There are several solutions for defining the operating mode of the security module.

A. Pre-configuration

During manufacture of the security module or during the personalization phase of the module, the security module is pre-configured to function according to the particular environment. This pre-programming can be changed during the different phases of the pre-configuration in the initialization environment.

B. Message Activation

At initialization, the module is in the basic mode and only communication means common to all guest devices are activated. According to a preconfiguration, the module may be in a particular mode that considers the purpose of such a module. To change the state of the security module and activate other functions, the module waits to receive a protection message, which allows the protection message to perform such a change. After decrypting such a message and only after confirmation of this message, the module will change its state to open the second communication means.

1 shows the overall structure of a security module;

2 shows control of an input / output port;

BRIEF DESCRIPTION OF THE DRAWINGS The invention will be better understood by reference to the following detailed description taken in conjunction with the accompanying drawings, in which: FIG.

1 shows an example of a security module including an embodiment of the present invention. According to this example, this module includes a first communication means COM0 and a second communication means COM1. Similarly, memory resources are divided into several parts (here two), such as MEM0 and MEM1, which can be used in a microprocessor program.

In this example, the module has a first encryption / decryption module ENC0 and a second encryption / decryption module ENC1.

According to the example of FIG. 1, the encryption / decryption module is connected to the high-speed second communication means COM1. The decoding of the audio / video data flow according to the DVB Common Descrambler standards or the user's descrambler becomes possible.

The other module is connected to the CPU processor, which coordinates the operation, initiates the module, and transfers the results from the module to the other module.

A specific module, called a state module (SM), controls activation and deactivation of a given module and more generally controls the operation of the security module. According to the specific example of Fig. 1, the status module SM controls the second communication means COM1, the second encryption / decryption means ENC1 and the second storage means MEM1. Depending on the state of this memory, signals that activate or deactivate the module are independently transmitted by the processor.

This activation is shown in FIG. 2, where the status module SM is sending a command to the first communication means COM0, which may also be, for example, a tri-state, Quot; MOSFET "or any other device that galvanically isolates the physical connection of the security module, such as an isolation circuit (TSB). This device can isolate the communication line by placing the communication line in high impedance mode. Thus, the status module controls the electrical activation / deactivation of the COM0 communication.

When the security module deactivates the first communication means COM0, the status module SM continuously monitors the activity on the first communication means COM0. The status module (SM) may issue a warning message if it continues to acknowledge the arrival of the parasite.

There are other ways to affect the status module (SM). As disclosed at the beginning, the security module determines which state corresponds to this unit according to the data received from the user's unit.

According to a variant using a secure message, the status of the status module changes when this message is received and acknowledged by the security module.

According to this variant, this message is decrypted and confirmed by the processor, and the result is stored in the status module SM. It thus acts as a memory with commands directed to the direction of the other modules concerned and acts as a monitoring module to monitor the activity of all communication paths.

According to another alternative example, all or some of the messages are handled directly by the status module SM. This message can be sent by the processor to the status module after it has been pre-processed by a key suitable for the security module contained in, for example, the first storage means MEMO. The status module has a clean key (Ksm) included in the message, which will be able to identify the command. This verification can be done according to some known methods, such as using a signature in a generalized message having an asymmetric key and another asymmetric key that is the key (Ksm) of the module of the state memory. The microprocessor can not access the state memory without knowing the key contained in the state module. Only the status module can accept messages prepared by the Management Center.

If the verification is correct, the new state is loaded into the state module and subsequent results appear on the other modules.

According to another process of the present invention, the status module performs a monitoring operation of the status of the security module. The status module receives, for example, the defined supply voltage Vdd (typically 5V), which goes to the supply module PS and observes a dangerous operation such as a sudden voltage change, or an abnormally high or low voltage. According to the prescribed standard, it will be possible to change its state without receiving a message, for example by generating an error message or deactivating a particular function of the module. The communication paths COM1 and COM0 are monitored by the status module SM. By way of communication path, it will be understood a path that passes input or output data to a security module, such as an I / O path according to the ISO 7816 standard, or a high speed data transfer port including a USB path or an infrared port. Thus, the connection path is other paths that are linked to the host module, such as the supply (Vdd, Vss), clock (CLK), reset (RST)

Likewise, if there are parasites and noise in the communication means such as the first communication means, the state can be changed or measures can be initiated. The status module SM may also include a monitoring profile that is specific to the communication path or monitoring connection on the one hand and the status of the status module on the other hand. Therefore, the verification parameter of the proper performance of the connection path may vary depending on the state of the status module. In one state, a voltage variation of +/- 10% is allowed, but in another state only +/- 5% may be allowed. This also applies to numbers such as parasites or microcuts. These parameters are programmable and can be modified by receiving a secure message.

This monitoring can also be done if the communication path or means is deactivated.

The status module (SM) may control the internal resources of the security module. The second storage means MEM1 may be partially or completely inactivated. This deactivation can also be achieved by electronic commands (read and / or record locking) or by acting directly on the supply of the memory. This memory can be defined according to the read-only, write-only or read / write states. This also applies to other resources of the security module such as the encryption / decryption module (ENC0, ENC1). The status module SM can control modules and / or functions that are allowed or prohibited depending on the status of the status module. Examples of these functions are the regular mechanism of the clock or the use of a high-speed data transfer internal bus. Examples of these modules are voltage regulators by a clock generator, an encryption / decryption module, a memory, and a charge pump.

The incoming message of the security module is preferably sent from the management center. This message can reach the security module by the first or second communication means. Upon initialization at the location of the security module and its host device, the message is transmitted via the host device to the security module. The management center recognizes the characteristics of the host device and the subscription of the relevant subscriber and formats the message for the security module containing the job status. This message may be a message that is unique to each security module, is the same for all security modules, and includes the version of the user unit and the security level of the security module. Thus, if there are eight different existing user units, then there will be eight messages in the transmission flow, each of which contains a configuration corresponding to the version of the user unit and the security module.

According to another embodiment, each host device stores a message, which is transmitted to the security module upon connection to the security module. The status of the security module will match the specification of the host device.

Once the security module has determined its state, it remains in this state and is therefore locked. In order for the security module to accept the new initialization, the management center may send a message allowing the new configuration process. This message may be conditional, that is, it may have a status of the security module version indication or status module as a restart condition.

Claims (14)

A first communication port connectable to the host device; A first storage device; A first decryption means; Status module; A second communication port; And An isolation circuit controlled by the status module and configured to isolate the second communication port, Wherein the status module is configured to receive a security message via the first and second communication ports and to modify the status of the status module that defines the accessibility of the security module with respect to the host device in response to the security message doing Security module. The method according to claim 1, Wherein the status module is configured to detect an activity on one communication port and to determine the status of the status module in accordance with the activity Security module. The method according to claim 1, Wherein the second communication port is connected to the host device by physically different contact with the contact of the first communication port Security module. The method according to claim 1, Wherein the isolation circuit comprises a conduction or isolation element of a three-phase or high-voltage bidirectional MOSFET type Security module. The method according to claim 1, Wherein the isolation circuit is arranged in series with the first communication port such that the isolation circuit is operated to electrically disconnect the first communication port Security module. The method according to claim 1, Wherein the isolation circuit is arranged in series with at least one connection path such that the isolation circuit is operated to electrically disconnect the connection path Security module. The method according to claim 1, The security module comprising a second storage device, Wherein the status module is configured to activate or deactivate the second storage device Security module. The method according to claim 1, Wherein the status module comprises a module in which access is permitted or forbidden, depending on the status of the status module Security module. 9. The method of claim 8, The status of the status module is configured to limit the access level for the second storage device to a read-only mode, a write-only mode, and a read / write mode Security module. The method according to claim 1, Wherein the security module comprises a second decryption means and the second decryption means is activated / deactivated by the status module Security module. 11. The method of claim 10, Wherein power is supplied to the second decryption means under the control of the status module Security module. The method according to claim 1, Wherein the status module includes a monitoring module configured to monitor parameters currently in operation on all connection paths of the security module and to allow the status of the status module to change according to a monitoring result Security module. 13. The method of claim 12, Wherein the monitoring module is connected to a connection path of the security module Security module. 13. The method of claim 12, Wherein the monitoring module comprises a monitoring profile of a communication path specific to each state of the state module Security module.

Images